MonitorWare Knowledge Base

[chajohari]

Hi
Forgive me if i am reading too much between lines as i am new to RSYSLOG

as i understand $ActionExecOnlyWhenPreviousIsSuspended works correctly based on the implementation of SUSPEND in output module. and currently 1)database write and the 2)syslog message forwarder(TCP) work properly.

my requirement is i will try to write logs to a file on one drive(C:\ volume, hard disk) if i couldn't succeed after some time ( may be due to drive failure), i would like to write in second log file on alternate drive (x:\, may be some flash drive, which is backup for my hard disk drive). is it possible with rsyslog? i tried using $ActionExecOnlyWhenPreviousIsSuspended directive between (/var) and (/opt) but both places it writes simultaneously.

this is my exact configuration ( execuse me if i understood ActionExecOnlyWhenPreviousIsSuspended functionality wrongly)

*.* /var/log/mylog/custom_file1
$ActionExecOnlyWhenPreviousIsSuspended On
& /opt/custom_file2
& /opt/custom_file3
$ActionExecOnlyWhenPreviousIsSuspended off

simultaneously creates custom_file1, custom_file2,custom_file3
is it because there is no output module involved in writing to plain text file?

can i achive what i am looking for by writing a custom module? or some other action mechanism i.e. shell script ?
is there any means to achieve it.

[rgerhards]

The older versions did not properly support this. However, v5 (and most probably the latest v4 *beta*) should be able to handle this.

[chajohari]

Thanks for the reply

i tried with version 5.5.2 (Cent OS 5.x)with two configurations

1) primiary logging onto USB drive and secondary to /var/log volume
2) primary on /var/log/cfile1 and secondary /var/log/cfile2 : ( deleted cfile1 when rsyslog running to make it log in cfile2)

both didnot behave as i was expecting

in first case
(1) Primary logging to file on USB drive(sdb1)...while rsyslog was logging i pulled the USB drive out but couldnt find logs getting redirected to secondary file on /var/log directory

EXT2-fs error (device sdb1): read_inode_bitmap: Cannot read inode bitmap - block_group = 0, inode_bitmap = 66
scsi 11:0:0:0: rejecting I/O to dead device
scsi 11:0:0:0: rejecting I/O to dead device
EXT2-fs error (device sdb1): read_inode_bitmap: Cannot read inode bitmap - block_group = 0, inode_bitmap = 66
scsi 11:0:0:0: rejecting I/O to dead device
scsi 11:0:0:0: rejecting I/O to dead device
EXT2-fs error (device sdb1): read_inode_bitmap: Cannot read inode bitmap - block_group = 0, inode_bitmap = 66

(2) while trying between multiple files

*.* /var/log/custom_file1
$ActionExecOnlyWhenPreviousIsSuspended on
& /var/log/custom_file2
$ActionExecOnlyWhenPreviousIsSuspended off

when rsyslog is running i deleted the custom_file1 but i couldnt find logs getting redirected to custom_file2 .
in rsyslog debug log i found

2275.430227000:b7f2cb90: we deleted 0 objects and enqueued 0 objects
2275.430236000:b7f2cb90: delete batch from store, new sizes: log 1, phys 1
2275.430245000:b7f2cb90: msgConsumer processes msg 0/1
2275.430254000:b7f2cb90: Called action, logging to builtin-file
2275.430264000:b7f2cb90: Action 0x8f6ec28 transitioned to state: itx
2275.430273000:b7f2cb90: entering actionCalldoAction(), state: itx
2275.430283000:b7f2cb90: file to log to: /var/log/custom_file1
2275.430292000:b7f2cb90: doWrite, pData->pStrm 0x8f6ef20, lenBuf 146
2275.430300000:b7f2cb90: action call returned -2121
2275.430309000:b7f2cb90: strm 0x8f6ef20: file 6 flush, buflen 146
2275.430322000:b7f2cb90: strm 0x8f6ef20: file 6 write wrote 146 bytes
2275.430333000:b7f2cb90: Action 0x8f6ec28 transitioned to state: rdy
2275.430342000:b7f2cb90: not calling action because the previous one is not suspended
2275.430350000:b7f2cb90: ruleset: get iRet 0 from rule.ProcessMsg()
2275.430358000:b7f2cb90: ruleset: get iRet 0 from rule.ProcessMsg()
2275.430367000:b7f2cb90: Called action, logging to builtin-file
2275.430377000:b7f2cb90: Action 0x8f712c8 transitioned to state: itx
2275.430385000:b7f2cb90: entering actionCalldoAction(), state: itx
2275.430394000:b7f2cb90: file to log to: /var/log/messages
2275.430403000:b7f2cb90: doWrite, pData->pStrm 0x8f70d40, lenBuf 146
2275.430412000:b7f2cb90: action call returned -2121


am i missing something.. unfortunately i couldnt collect RSYSLOG Debug Logs when USB Drive was pulled
any suggestion would be helpful

thanks
chajo